IIS component registered through AppCmd configuration change

Siemphony@siemphonymediumT1505.004unverifiedPlaybook · Persistence established

Matches AppCmd.exe being used to register an ISAPI filter, ISAPI extension or native/managed module against the IIS configuration — the administrative-tool half of AN0184, which also lists direct DLL drop and module load as observables but those need a watch on %windir%\System32\inetsrv\ or a diff of loaded modules in w3wp.exe that Sigma's single-event model cannot express against the file_event and image_load logsources in this brief without also matching every ordinary IIS content deployment. AppCmd is chosen instead because the configuration verbs that actually wire in a component — set config against the isapiFilters/globalModules sections, or add module — are literal, stable strings on its command line, so the selector cannot be defeated by a version-suffixed binary or a GUI wrapper the way a raw DLL-drop watch would be. There is no "add filter" verb in AppCmd; ISAPI filters are registered by writing the isapiFilters section, which is why that section name rather than a verb carries the filter arm here. The gate is appcmd.exe itself, so registering the component through the IIS configuration API (Microsoft.Web.Administration from PowerShell or C#) or by hand-editing applicationHost.config is invisible to this rule. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0068, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: IIS component registered through AppCmd configuration change2id: 64605540-de84-479b-81bd-42485c1f81fe3status: experimental4description: |5  Matches AppCmd.exe being used to register an ISAPI filter, ISAPI extension or6  native/managed module against the IIS configuration — the administrative-tool7  half of AN0184, which also lists direct DLL drop and module load as observables8  but those need a watch on %windir%\System32\inetsrv\ or a diff of loaded modules9  in w3wp.exe that Sigma's single-event model cannot express against the file_event10  and image_load logsources in this brief without also matching every ordinary IIS11  content deployment. AppCmd is chosen instead because the configuration verbs that12  actually wire in a component — set config against the isapiFilters/globalModules13  sections, or add module — are literal, stable strings on its command line, so the14  selector cannot be defeated by a version-suffixed binary or a GUI wrapper the way15  a raw DLL-drop watch would be. There is no "add filter" verb in AppCmd; ISAPI16  filters are registered by writing the isapiFilters section, which is why that17  section name rather than a verb carries the filter arm here. The gate is18  appcmd.exe itself, so registering the component through the IIS configuration19  API (Microsoft.Web.Administration from PowerShell or C#) or by hand-editing20  applicationHost.config is invisible to this rule.21  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0068, not hand-written and not tested by its author. Any lab result is on this rule's own page.22references:23  - https://attack.mitre.org/techniques/T1505/00424  - https://attack.mitre.org/detectionstrategies/DET006825author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)26date: 2026-08-1627tags:28  - attack.persistence29  - attack.t1505.00430logsource:31  category: process_creation32  product: windows33detection:34  selection_tool:35    Image|endswith: '\appcmd.exe'36  selection_verb:37    CommandLine|contains:38      - 'isapiFilters'39      - 'globalModules'40      - 'system.webServer/modules'41      - 'add module'42  condition: selection_tool and selection_verb43falsepositives:44  - "Release-management and CI/CD agents (Web Deploy, Octopus Deploy, Azure DevOps release tasks) that call appcmd.exe to register a legitimate ISAPI module or filter as part of an application deployment — this is the loudest source in any environment that automates IIS deploys and looks identical to the abuse case."45  - "Windows feature and product installers (URL Rewrite, Application Request Routing, ASP.NET registration via aspnet_regiis) that invoke appcmd set config against globalModules to wire in their own bundled module immediately after MSI or platform-installer setup."46  - "Hardening and compliance scripts that reapply a baseline IIS configuration, including re-adding an approved filter or module entry, on a schedule or at image-build time."47level: medium

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (FolderPath endswith "\\appcmd.exe" and (ProcessCommandLine contains "isapiFilters" or ProcessCommandLine contains "globalModules" or ProcessCommandLine contains "system.webServer/modules" or ProcessCommandLine contains "add module"))

Splunk · SPL

Run this as a search.

index=* (Image="*\\appcmd.exe" AND (CommandLine="*isapiFilters*" OR CommandLine="*globalModules*" OR CommandLine="*system.webServer/modules*" OR CommandLine="*add module*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.executable) LIKE "*\\\\appcmd.exe" AND (TO_LOWER(process.command_line) LIKE "*isapifilters*" OR TO_LOWER(process.command_line) LIKE "*globalmodules*" OR TO_LOWER(process.command_line) LIKE "*system.webserver/modules*" OR TO_LOWER(process.command_line) LIKE "*add module*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\appcmd\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(isapiFilters|globalModules|system\.webServer/modules|add module)</field>    <description>IIS component registered through AppCmd configuration change</description>    <mitre>      <id>T1505.004</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: registry_persistence
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 64605540-de84-479b-81bd-42485c1f81fe

ATT&CKT1505.004

T1505.004IIS Components

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1505.004, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add additional keywords to the selection_verb section to include other IIS-related commands that may be used for registry persistence
Modify the selection_tool section to include other tools or executables that may be used to register IIS components
Add a filter to exclude events where the CommandLine field contains specific benign keywords or phrases, such as "list" or "query"

Declared by the author

Release-management and CI/CD agents (Web Deploy, Octopus Deploy, Azure DevOps release tasks) that call appcmd.exe to register a legitimate ISAPI module or filter as part of an application deployment — this is the loudest source in any environment that automates IIS deploys and looks identical to the abuse case.
Windows feature and product installers (URL Rewrite, Application Request Routing, ASP.NET registration via aspnet_regiis) that invoke appcmd set config against globalModules to wire in their own bundled module immediately after MSI or platform-installer setup.
Hardening and compliance scripts that reapply a baseline IIS configuration, including re-adding an approved filter or module entry, on a schedule or at image-build time.

Lessonregistry persistence

registry persistenceAI draft — unreviewed

01 · What this rule detects

This Sigma rule detects the registration of an IIS component through an AppCmd configuration change, which is a technique used for registry persistence. The rule focuses on identifying when the appcmd.exe tool is used to add or modify ISAPI filters, global modules, or system web server modules, as these changes can be used by attackers to maintain persistence on a compromised system.

02 · Telemetry you need

Log source: process creation events
Specific fields: Image, CommandLine
Audit setting: Process creation events must be audited, which may require enabling audit policies for process creation

03 · How the logic works

The rule works by selecting process creation events where the Image field ends with \appcmd.exe, indicating that the AppCmd tool is being used. It then further selects events where the CommandLine field contains specific keywords related to IIS component registration, such as isapiFilters, globalModules, system.webServer/modules, or add module. The condition requires both the tool selection and the verb selection to be true, meaning that the rule will only trigger when the AppCmd tool is used with one of the specified commands.

04 · Common false positives

IIS administration tools and scripts that use AppCmd to manage IIS components
Web application installation and configuration processes that involve registering ISAPI filters or modules
System management and monitoring tools that use AppCmd to query or modify IIS settings

05 · Detection maturity

tier_1: The rule as written provides basic detection capabilities for IIS component registration through AppCmd configuration changes, but may generate false positives due to benign administrative activity.
tier_2: The rule tuned with additional keywords and filters can provide more accurate detection with reduced noise, but may still require manual analysis to confirm true positives.
tier_3: The rule correlated with other signals, such as suspicious network activity or anomalous system calls, can provide high-confidence detection of registry persistence techniques and support more effective incident response.

Related detections1 nearby

Command line sets a custom .NET AppDomainManager assembly

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/64605540-de84-479b-81bd-42485c1f81fe

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

IIS component registered through AppCmd configuration change

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it